Question Why is cipher with 3 passes much faster than sdelete with 1 pass?

[v9t0fntwkrkdeqvi]

I ran cipher to wipe free space on an HDD and it completed 3 passes in around 40 minutes, while sdelete with 1 pass needed 6 hours. Is there a reason for the time difference, or are both of them doing something different?

 

[Ralston18]

Cipher as in Powershell?

= = = =

Probably just doing the wipes differently.

Wiping free space versus wiping everything.

Could be different configurations in the software/tool/utility as well.

To make a fair comparison between the two would require identical systems, drives, configurations, etc..

 

[BFG-9000]

Theoretically, cipher /w:C (where C is the letter of the drive or partition you want to wipe free space on) is equivalent to sdelete -c C: /accepteula which means 3 passes over free space

However the documentation for earlier versions than v1.6 reversed the functions of -c and -z --especially confusing because when running with either, it always starts by displaying "zeroing"...

-z Zero free space--fills with zeroes only so single pass
-c Clean free space to military DoD standards--fills with random data which is obviously no good for TRIM, by first writing zeroes (0x00), then 255s (0xFF) and finally with random numbers so writes three times

Also, SDelete v2.0 had a severe bug making it take 10-28x as long to do the job, because it stalled at 100% doing nothing. I don't know about the current version v2.04 as I have always been happy with the performance of v1.61. So it could be some combination of the above or v2.04 just still takes longer than versions before v2.

As an aside all of the SSDs and systems that do not support TRIM that I've zero-filled with sdelete -z C: /accepteula seem to have been smart enough to recognize all zeroes as free space. Some old SSD firmware however may require all 1s instead!

 

[v9t0fntwkrkdeqvi]

Theoretically, cipher /w:C (where C is the letter of the drive or partition you want to wipe free space on) is equivalent to sdelete -c C: /accepteula which means 3 passes over free space

However the documentation for earlier versions than v1.6 reversed the functions of -c and -z --especially confusing because when running with either, it always starts by displaying "zeroing"...

-z Zero free space--fills with zeroes only so single pass
-c Clean free space to military DoD standards--fills with random data which is obviously no good for TRIM, by first writing zeroes (0x00), then 255s (0xFF) and finally with random numbers so writes three times

Also, SDelete v2.0 had a severe bug making it take 10-28x as long to do the job, because it stalled at 100% doing nothing. I don't know about the current version v2.04 as I have always been happy with the performance of v1.61. So it could be some combination of the above or v2.04 just still takes longer than versions before v2.

I used sdelete -c C:
With version 2.04

It says set for 1 pass, I assume because the documentation says default is 1 pass if -p is not set.
For 1 pass, it's extremely slow. (edit: maybe it's doing a set of several passes, but defaults to running the set only 1 time, but cipher/w:C also does 3 steps of 0, 1, and random, so Don't know why it's so much faster.)

I wonder if sdelete64 would be any faster. But I think I'll use cipher /w:C since it's more than 10 times faster.

 

[v9t0fntwkrkdeqvi]

Actually, after cipher, I was able to use Recuva to recover thousands of old files intact. So I'm not sure if cipher is actually working.
During cipher's wipe, the documentation says the HDD should be filled completely, but the free space did not change at all while it was running.

However, sdelete eventually took 15 hours compared to cipher which was 40 minutes.
I'm running Recuva again after sdelete, and waiting for completion to check for recoverability, but the current status also says several thousands of old files found.

I'm wondering if there is no secure way to wipe free space, and if it's simply better to wipe the whole drive with parted magic. But the effect is having to copy paste again the files that I didn't want to delete.

 

[Ralston18]

Just for the record: What version of Recuva?

 

[v9t0fntwkrkdeqvi]

Just for the record: What version of Recuva?

I tried the current version and 3 releases prior.

Edit: Actually, I was confusing the "un-deleted" files with the checkmark to display those files in the options.

Most of those files that I saw after running the wipes were actually files that weren't deleted but shown in the Recuva results.
Other files that I saw that were deleted, but said recoverable, were actually names found from the MFT, but not readable.

I'm going to try the MFT option in the ccleaner wiper to see if that helps remove file names from a HDD.

But on an SSD, I think there's no way to clear the MFT of deleted file names.